Lion Cipher Lab
Read capa output: turn identified capabilities into a plain-language malware summary
- Digital Forensics & IR (DFIR)
- Intermediate
- ~40 min
- Free · no account required
Why it matters
When a suspicious file lands on an analyst's desk, the first question a manager, an IR lead, or an interviewer asks is simple: 'What does it do?' You have minutes, not hours, and you usually can't reverse-engineer the whole binary before you answer. capa, from Mandiant's FLARE team, is the tool the industry reaches for to get a fast, structured behavioral overview: it reads the disassembly, matches its rules, and hands you a list of capabilities already mapped to MITRE ATT&CK. But capa gives you a LIST — the skill that gets you hired is turning that list into a sentence a human can act on…
What you'll learn
- reading capa's three output tables (ATT&CK, MBC, and the capabilities list)
- understanding capa's model: rules over disassembled features, not signatures
- mapping an identified capability to its ATT&CK technique and rule namespace
- translating a raw capability list into a plain-language 'what this malware does' paragraph
- using capa as a triage accelerator to prioritize which functions to reverse next
- judgment: capability is not intent, and capa can't see packed/obfuscated code
- safe-handling discipline: analyze real samples only in an isolated VM you own
Steps in this lab
- The scenario, and the one rule for touching real malware
- What capa is, and why it isn't antivirus
- The report, part 1 — the two mapping tables (ATT&CK and MBC)
- The report, part 2 — the capabilities table (the heart of it)
- How to read a namespace back to a technique (worked example)
- The deliverable — write the plain-language summary
- Do it better: use capa to PRIORITIZE what to reverse next
- When capa's view is right — and where it is blind